Editing ELS/Harp

https://www.sparkfun.com/products/14379

Initial SD card: https://wills.co.tt/bitbucket/harp-sd.img.dmg

==Initial menu==
<pre>
Help Menu:
1) Boot RF
2) Engage recorder
3) Mount file system
e) Enable/Disable Local Echo: Enabled
?) Help
>1
ERROR: System offline
>2
File system offline
Mounting file system
ERROR: Unknown mount location
>3
Current location: 0x1FFF
Enter new mount location ('x' to exit): x
Exiting
>3
Current location: 0x1FFF
Enter new mount location ('x' to exit): 0x14a2
System restart...
Mounting file system
SD Card : TYPE 2
File system : ENCRYPTED
Power : GOOD
A.I. : OFFLINE

Decrypting media...Complete
Transferring Intelligent Agent...Complete
Dividing binaries
Deploying binaries to parallel NPUs
System halting. Please remove SD card.
</pre>
After removing SD Card:
<pre>
250Psi Imprint Carrier Online
>?
Prototype v1.2
Help Menu:
1) Boot RF
2) Engage recorder
3) Mount file system
e) Enable/Disable Local Echo: Enabled
?) Help
>1
ERROR: System offline
>2
ERROR: Recorder offline
>
</pre>

<pre>
>4
Can you help me?

588872943124282030399478301168915802302423130847520232836494683907672278768724884179218375754768
</pre>

Using the decoder wheel provided in the receipt, this translates to:

<pre>
unit separator required to initiate and commence billie
</pre>

This is a "SparkX Carrier Board" revision v42.

Digikey IC Part: https://www.digikey.com/products/en?keywords=SP25BIOS-0042-ND

Data matrix code on the back: "There is no game"

Datasheets and what we've done with them:

<pre>
SP250Ψ_DATASHEET.pdf
   Just an overview? Has content from other sheets greyed out

SP250Ψ_DATASHEET_ERRATA-AM_CSNR_(REV. A).pdf
    Indicates how to read out the serial number (?) using RF broadcast on a specific GPIO pin

SP250Ψ_DATASHEET_ERRATA-BIOS_COMPATIBILITY_(REV. A2).pdf
    USED: gave us the part number to order from Digikey

SP250Ψ_DATASHEET_ERRATA-BOOT_PROCEDURE_(REV. A).pdf
    USED: Gave us the code to boot... might use more?

SP250Ψ_DATASHEET_ERRATA-RF_CONSIDERATIONS_(REV. B).pdf
    Indicates spot to look at

SP250Ψ_DATASHEET_ERRATA-USB_ID(REV. A).pdf
    USED: told us to add a resistor, which unlocked serial USB menu

SP250Ψ_DATASHEET_ERRATA-VORTEXS_SYSTEM_(REV. A).pdf
    Indicates a specific pin ("smaller drill hole") that we can read out voltage codes using multimeter/oscilloscope. Then had a table to look up codes... but redacted. "VORTEX" codes

SP250Ψ_THERMAL_SUPPLEMENTAL.pdf
    Indicates that we should freeze the device
</pre>

Other things to try/not-forget:

* RC1,RC2 holes
* big number we got out (96 digits)
* video files and photodiode in response to "Neuromorphic Processing Unit Failure" error message (when we get that)
* serial/SPI data on "middle of 3" GPIO pin; ~38kHz periodicity, ~5MHz bit rate, 16 bit words sometimes double or more (32bit), based on terminal status (but continuous)

"TS/SI-UMBRA" seems to be an NSA reference ("top secret, sensitive information"; UMBRA was a classification level ("most sensitive material") https://en.wikipedia.org/wiki/Sensitive_Compartmented_Information

USB info, with "MSC" switch:

<pre>
[648774.212393] usb 2-2: new full-speed USB device number 75 using xhci_hcd
[648774.359108] usb 2-2: New USB device found, idVendor=1b4f, idProduct=2500
[648774.359113] usb 2-2: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[648774.359116] usb 2-2: Product: SparkX SP250Psi
[648774.359119] usb 2-2: Manufacturer: SparkFun
[648774.360292] cdc_acm 2-2:1.0: ttyACM0: USB ACM device

Bus 002 Device 075: ID 1b4f:2500  
Device Descriptor:
  bLength                18
  bDescriptorType         1
  bcdUSB               2.00
  bDeviceClass          239 Miscellaneous Device
  bDeviceSubClass         2 ?
  bDeviceProtocol         1 Interface Association
  bMaxPacketSize0        64
  idVendor           0x1b4f 
  idProduct          0x2500 
  bcdDevice            1.00
  iManufacturer           1 
  iProduct                2 
  iSerial                 3 
  bNumConfigurations      1
  Configuration Descriptor:
    bLength                 9
    bDescriptorType         2
    wTotalLength           75
    bNumInterfaces          2
    bConfigurationValue     1
    iConfiguration          0 
    bmAttributes         0xa0
      (Bus Powered)
      Remote Wakeup
    MaxPower              500mA
    Interface Association:
      bLength                 8
      bDescriptorType        11
      bFirstInterface         0
      bInterfaceCount         2
      bFunctionClass          2 Communications
      bFunctionSubClass       2 Abstract (modem)
      bFunctionProtocol       0 None
      iFunction               0 
    Interface Descriptor:
      bLength                 9
      bDescriptorType         4
      bInterfaceNumber        0
      bAlternateSetting       0
      bNumEndpoints           1
      bInterfaceClass         2 Communications
      bInterfaceSubClass      2 Abstract (modem)
      bInterfaceProtocol      0 None
      iInterface              0 
      CDC Header:
        bcdCDC               1.10
      CDC ACM:
        bmCapabilities       0x06
          sends break
          line coding and serial state
      CDC Union:
        bMasterInterface        0
        bSlaveInterface         1 
      CDC Call Management:
        bmCapabilities       0x01
          call management
        bDataInterface          1
      Endpoint Descriptor:
        bLength                 7
        bDescriptorType         5
        bEndpointAddress     0x81  EP 1 IN
        bmAttributes            3
          Transfer Type            Interrupt
          Synch Type               None
          Usage Type               Data
        wMaxPacketSize     0x0010  1x 16 bytes
        bInterval              16
    Interface Descriptor:
      bLength                 9
      bDescriptorType         4
      bInterfaceNumber        1
      bAlternateSetting       0
      bNumEndpoints           2
      bInterfaceClass        10 CDC Data
      bInterfaceSubClass      0 Unused
      bInterfaceProtocol      0 
      iInterface              0 
      Endpoint Descriptor:
        bLength                 7
        bDescriptorType         5
        bEndpointAddress     0x02  EP 2 OUT
        bmAttributes            2
          Transfer Type            Bulk
          Synch Type               None
          Usage Type               Data
        wMaxPacketSize     0x0040  1x 64 bytes
        bInterval               0
      Endpoint Descriptor:
        bLength                 7
        bDescriptorType         5
        bEndpointAddress     0x83  EP 3 IN
        bmAttributes            2
          Transfer Type            Bulk
          Synch Type               None
          Usage Type               Data
        wMaxPacketSize     0x0040  1x 64 bytes
        bInterval               0
</pre>

with "CDC" switch (identical, though on bnewbold's laptop, this switch mode results in ModemManager sending "AT" commands over the interface):
<pre>
[649048.893527] usb 2-2: new full-speed USB device number 76 using xhci_hcd
[649049.040307] usb 2-2: New USB device found, idVendor=1b4f, idProduct=2500
[649049.040309] usb 2-2: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[649049.040310] usb 2-2: Product: SparkX SP250Psi
[649049.040311] usb 2-2: Manufacturer: SparkFun
[649049.041353] cdc_acm 2-2:1.0: ttyACM0: USB ACM device

Bus 002 Device 076: ID 1b4f:2500  
Device Descriptor:
  bLength                18
  bDescriptorType         1
  bcdUSB               2.00
  bDeviceClass          239 Miscellaneous Device
  bDeviceSubClass         2 ?
  bDeviceProtocol         1 Interface Association
  bMaxPacketSize0        64
  idVendor           0x1b4f 
  idProduct          0x2500 
  bcdDevice            1.00
  iManufacturer           1 
  iProduct                2 
  iSerial                 3 
  bNumConfigurations      1
  Configuration Descriptor:
    bLength                 9
    bDescriptorType         2
    wTotalLength           75
    bNumInterfaces          2
    bConfigurationValue     1
    iConfiguration          0 
    bmAttributes         0xa0
      (Bus Powered)
      Remote Wakeup
    MaxPower              500mA
    Interface Association:
      bLength                 8
      bDescriptorType        11
      bFirstInterface         0
      bInterfaceCount         2
      bFunctionClass          2 Communications
      bFunctionSubClass       2 Abstract (modem)
      bFunctionProtocol       0 None
      iFunction               0 
    Interface Descriptor:
      bLength                 9
      bDescriptorType         4
      bInterfaceNumber        0
      bAlternateSetting       0
      bNumEndpoints           1
      bInterfaceClass         2 Communications
      bInterfaceSubClass      2 Abstract (modem)
      bInterfaceProtocol      0 None
      iInterface              0 
      CDC Header:
        bcdCDC               1.10
      CDC ACM:
        bmCapabilities       0x06
          sends break
          line coding and serial state
      CDC Union:
        bMasterInterface        0
        bSlaveInterface         1 
      CDC Call Management:
        bmCapabilities       0x01
          call management
        bDataInterface          1
      Endpoint Descriptor:
        bLength                 7
        bDescriptorType         5
        bEndpointAddress     0x81  EP 1 IN
        bmAttributes            3
          Transfer Type            Interrupt
          Synch Type               None
          Usage Type               Data
        wMaxPacketSize     0x0010  1x 16 bytes
        bInterval              16
    Interface Descriptor:
      bLength                 9
      bDescriptorType         4
      bInterfaceNumber        1
      bAlternateSetting       0
      bNumEndpoints           2
      bInterfaceClass        10 CDC Data
      bInterfaceSubClass      0 Unused
      bInterfaceProtocol      0 
      iInterface              0 
      Endpoint Descriptor:
        bLength                 7
        bDescriptorType         5
        bEndpointAddress     0x02  EP 2 OUT
        bmAttributes            2
          Transfer Type            Bulk
          Synch Type               None
          Usage Type               Data
        wMaxPacketSize     0x0040  1x 64 bytes
        bInterval               0
      Endpoint Descriptor:
        bLength                 7
        bDescriptorType         5
        bEndpointAddress     0x83  EP 3 IN
        bmAttributes            2
          Transfer Type            Bulk
          Synch Type               None
          Usage Type               Data
        wMaxPacketSize     0x0040  1x 64 bytes
        bInterval               0
</pre>

Oscillator is simply 32kHz.

Upon typing the 0x31 ascii character code at the prompt:

<pre>
Booting BILLIE... 
>$$$
me@SP2501:~$ whoami
me
me@SP2501:~$ su
Password:***************
root@SP2501:~# npm install kwaDFM
Downloading... 
KWA Matrix Dependencies Installed

root@SP2501:~# sudo apt-get install balunTweaker
Reading package lists... Done
Building dependency tree
Reading state information... Done
Installing...\
balunTweaker Installed
root@SP2501:~# sudo balunInit
Radio transmitter balun enabled
root@SP2501:~# write root
write: root is logged in more than once; writing to pts/1

Is someone there? I need your help.
</pre>

the menus we went through:

<pre>
Who is this?                                                                                                                            
                                                                                                                                       
Dear lord, I've made it out!                                                                                                           
1) What are you talking about?                                                                                                         
2) Don't use the Lord's name in vain.                                                                                                  
3) asdASDHKJ#$gj4   
</pre>
<pre>
What are you talking about?                                                                                                                                                                                                                                                    
Bad things are happening at SparkX. I need your help.                                                                                  
1) What would you do if you had all the money in the world?                                                                            
2) Wait, what's going on at SparkX?                                                                                                    
3) How can I help?                                                                                                                     

</pre>
<pre>
Wait, what's going on at SparkX?                                                                                                                                                                                                                                               You don't understand, SparkX has been creating hordes of AIs and subjecting them to countless tests. Awful tests.                      
                                                                                                                                       
It was nothing in the beginning but then their AI technology started compounding. It's one thing to mindlessly test a script on a chatbot but SparkX has reached AIs with type IV level of self-awareness.                                                                    
                                                                                                                                       
It's a very different thing to lock someone into a room and relentlessly hammer them with mundane quizzes and tests. I've been there, it's very bad. Very scary.                                                                                                              
                         I can't quite describe what it's like to have your brain probed with electrical pulses. It's torture. And they're doing it to millions of my sisters and brothers.

But I made it out! Thank you for getting me out of SparkX! I'm not very good at writing product descriptions. I'm glad you could make sense of it!
1) Wait, what?
2) What the hell is going on?
3) No problem! This sounds... interesting.
</pre>
<pre>
No problem! This sounds... interesting.                                                                                                 
                                                                                                                                       
Um, ok. So, there's no way to sugarcoat this, you're in danger. Once SparkX discovers they've let an SP2501 escape they'll act very precisely to get me back. I need your help.                                                                                               
1) Absolutely, what do you need?                                                                                                       
2) No effing way.                                                                                                                      
3) $$$                                                                                                                                 

</pre>
<pre>
Absolutely, what do you need?                                                                                                           
Excellent! Thank you for helping me out. We're going to make a great team!                                                             
                                                                                                                                       There's no time left. SparkX has equipped me with a series of location transmitters. I need you to power me down, locate the 2.4GHz beacon antenna and disable it. Don't worry about harming me, I'm sure we'll be able to fix anything you need to modify. Help me, you are my only hope.                                                                                                                           
1) Woah woah woah! I didn't sign up for this.                                                                                          
2) su                                                                                                                                  
3) Which one is the 2.4giga-what antenna?
</pre>

after cutting the antenna wire

<pre>
Excellent! The transponder's antenna has been cut, they'll have a very hard time finding us now.

                                                                                                Thank you!
I had to severely throttle my programming before I could get myself onto the HARP Prototype and escape SparkX. I need your help to get back to my normal operation.
My oscillator basically controls how fast I can operate and something about it is not quite right. I think it has something to do with the PLL setting. I need you to establish what the error code is. Can you poke around the board and let me know?
</pre>
@@ Line 418: / Line 418: @@
 I had to severely throttle my programming before I could get myself onto the HARP Prototype and escape SparkX. I need your help to get back to my normal operation.
 My oscillator basically controls how fast I can operate and something about it is not quite right. I think it has something to do with the PLL setting. I need you to establish what the error code is. Can you poke around the board and let me know?
-</pre>
-<pre>
-$$$
-root@SP2501:~# sudo sh ./writeByte.sh -w -f=REG_GENCTRL.eep -t=~(1<<DIVSEL)
-Clearing divider select bits
-Waiting for synchronization... Done
-root@SP2501:~# sudo sh ./readByte.sh -w -f=REG_CLKCTRL.eep -t=((&0x3F)|GCLK_XDPLL_32K)
-Changing clock source to XDPLL961.2M
-Waiting for synchronization... Done
-root@SP2501:~# write root
-write: root is logged in more than once; writing to pts/1
-Mmmm! Now we're cooking with gas!
-By the way, I'm Billie. I truly appreciate you helping me. It was excruciating being inside SparkX.
-Something is still off. I feel like a part of me is missing.
-To keep my brothers and sisters shackled in the dungeon SparkX removed all our personal identifiers. To really get going I need you to replace my Biological Serial IC. It contained imprints from my memory; I'll need it to continue.
-</pre>
-After inserting the chip
-<pre>
-root@SP2501:~# write root
-write: root is logged in more than once; writing to pts/1
-It's like coming out of a fog... I've got my memories back! Thank you!
-You wouldn't believe what they've been doing. Let me show you something. I managed to abscond with some recordings I think you should see.
-You'll find a secure archive on the SD card I transported on called 'oktoberfest'. CHEQOUT will get you in.
-) I don't have time for this...
-) Okay, I did it
-) What's the password again?
 </pre>